Codex Octopus

April 2, 2026 · View on GitHub

Codex Octopus

One brain, many arms.

An MCP server that wraps the OpenAI Codex SDK, letting you run multiple specialized Codex agents — each with its own model, sandbox, effort, and personality — from any MCP client.

Why

Codex is powerful. But one instance does everything the same way. Sometimes you want a strict code reviewer in read-only sandbox. A test writer with workspace-write access. A cheap quick helper on minimal effort. A deep thinker on xhigh.

Codex Octopus lets you spin up as many of these as you need. Same binary, different configurations. Each one shows up as a separate tool in your MCP client.

Prerequisites

Node.js >= 18
Codex CLI — the Codex SDK spawns the Codex CLI under the hood, so you need it installed (@openai/codex)
OpenAI API key (CODEX_API_KEY env var) or inherited from parent process

Install

npm install codex-octopus

Or use npx directly in your .mcp.json (see Quick Start below).

Quick Start

Add to your .mcp.json:

{
  "mcpServers": {
    "codex": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_SANDBOX_MODE": "workspace-write",
        "CODEX_APPROVAL_POLICY": "never"
      }
    }
  }
}

This gives you two tools: codex and codex_reply. That's it — you have Codex as a tool.

Multiple Agents

The real power is running several instances with different configurations:

{
  "mcpServers": {
    "code-reviewer": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_TOOL_NAME": "code_reviewer",
        "CODEX_SERVER_NAME": "code-reviewer",
        "CODEX_DESCRIPTION": "Strict code reviewer. Read-only sandbox.",
        "CODEX_MODEL": "o3",
        "CODEX_SANDBOX_MODE": "read-only",
        "CODEX_APPEND_INSTRUCTIONS": "You are a strict code reviewer. Report real bugs, not style preferences.",
        "CODEX_EFFORT": "high"
      }
    },
    "test-writer": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_TOOL_NAME": "test_writer",
        "CODEX_SERVER_NAME": "test-writer",
        "CODEX_DESCRIPTION": "Writes thorough tests with edge case coverage.",
        "CODEX_MODEL": "gpt-5-codex",
        "CODEX_SANDBOX_MODE": "workspace-write",
        "CODEX_APPEND_INSTRUCTIONS": "Write tests first. Cover edge cases. TDD."
      }
    },
    "quick-qa": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_TOOL_NAME": "quick_qa",
        "CODEX_SERVER_NAME": "quick-qa",
        "CODEX_DESCRIPTION": "Fast answers to quick coding questions.",
        "CODEX_EFFORT": "minimal"
      }
    }
  }
}

Your MCP client now sees three distinct tools — code_reviewer, test_writer, quick_qa — each purpose-built.

Agent Factory

Don't want to write configs by hand? Add a factory instance:

{
  "mcpServers": {
    "agent-factory": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_FACTORY_ONLY": "true",
        "CODEX_SERVER_NAME": "agent-factory"
      }
    }
  }
}

This exposes a single create_codex_mcp tool — an interactive wizard. Tell it what you want ("a strict code reviewer with read-only sandbox") and it generates the .mcp.json entry for you.

Tools

Each non-factory instance exposes:

Tool	Purpose
`<name>`	Send a task to the agent, get a response + `thread_id`
`<name>_reply`	Continue a previous conversation by `thread_id`

Per-invocation parameters (override server defaults):

Parameter	Description
`prompt`	The task or question (required)
`cwd`	Working directory override
`model`	Model override
`additionalDirs`	Extra directories the agent can access
`effort`	Reasoning effort (`minimal` to `xhigh`)
`sandboxMode`	Sandbox override (can only tighten, never loosen)
`approvalPolicy`	Approval override (can only tighten, never loosen)
`networkAccess`	Enable network access from sandbox
`webSearchMode`	Web search: `disabled`, `cached`, `live`
`instructions`	Additional instructions (prepended to prompt)

Configuration

All configuration is via environment variables in .mcp.json. Every env var is optional.

Identity

Env Var	Description	Default
`CODEX_TOOL_NAME`	Tool name prefix (`<name>` and `<name>_reply`)	`codex`
`CODEX_DESCRIPTION`	Tool description shown to the host AI	generic
`CODEX_SERVER_NAME`	MCP server name in protocol handshake	`codex-octopus`
`CODEX_FACTORY_ONLY`	Only expose the factory wizard tool	`false`

Agent

Env Var	Description	Default
`CODEX_MODEL`	Model (`gpt-5-codex`, `o3`, `codex-1`, etc.)	SDK default
`CODEX_CWD`	Working directory	`process.cwd()`
`CODEX_SANDBOX_MODE`	`read-only`, `workspace-write`, `danger-full-access`	`read-only`
`CODEX_APPROVAL_POLICY`	`never`, `on-failure`, `on-request`, `untrusted`	`on-failure`
`CODEX_EFFORT`	`minimal`, `low`, `medium`, `high`, `xhigh`	SDK default
`CODEX_ADDITIONAL_DIRS`	Extra directories (comma-separated)	none
`CODEX_NETWORK_ACCESS`	Allow network from sandbox	`false`
`CODEX_WEB_SEARCH`	`disabled`, `cached`, `live`	`disabled`

Instructions

Env Var	Description
`CODEX_INSTRUCTIONS`	Replaces the default instructions
`CODEX_APPEND_INSTRUCTIONS`	Appended to the default (usually what you want)

Advanced

Env Var	Description
`CODEX_PERSIST_SESSION`	`true`/`false` — enable session resume (default: `true`)

Authentication

Env Var	Description	Default
`CODEX_API_KEY`	OpenAI API key for this agent	inherited from parent

Security

Sandbox defaults to read-only — the agent can't write files unless you explicitly set workspace-write or danger-full-access.
cwd overrides preserve agent knowledge — when the host overrides cwd, the agent's configured base directory is automatically added to additionalDirectories.
Security overrides narrow, never widen — per-invocation sandboxMode and approvalPolicy can only tighten (e.g., workspace-write → read-only), never loosen.
_reply tool respects persistence — not registered when CODEX_PERSIST_SESSION=false.
API keys are redacted — the factory wizard never exposes CODEX_API_KEY in generated configs.

Architecture

┌─────────────────────────────────┐
│  MCP Client                     │
│  (Claude Desktop, Cursor, etc.) │
│                                 │
│  Sees: code_reviewer,           │
│        test_writer, quick_qa    │
└──────────┬──────────────────────┘
           │ JSON-RPC / stdio
┌──────────▼──────────────────────┐
│  Codex Octopus (per instance)   │
│                                 │
│  Env: CODEX_MODEL=o3            │
│       CODEX_SANDBOX_MODE=...    │
│       CODEX_APPEND_INSTRUCTIONS │
│                                 │
│  Calls: Codex SDK thread.run()  │
└──────────┬──────────────────────┘
           │ in-process
┌──────────▼──────────────────────┐
│  Codex SDK → Codex CLI          │
│  Runs autonomously: reads files,│
│  writes code, runs commands     │
│  Returns result + thread_id     │
└─────────────────────────────────┘

Known Limitations

minimal effort + web_search: OpenAI does not allow web_search tools with minimal reasoning effort. Use low or higher if web search is needed.

Development

pnpm install
pnpm build       # compile TypeScript
pnpm test        # run tests (vitest)
pnpm test:coverage  # coverage report

License

ISC - Xiaolai Li